CVE-2026-44744

MediumCVSS 6.5/10Last modified Jul 23, 2026

Description

SAP S/4HANA(On-Premise) contains SQL injection vulnerability in a remote-enabled function module component that could be exploited by an authenticated attacker to potentially execute unauthorized database queries.This flaw exposes sensitive information to which they should not otherwise have access to. The vulnerability has a high impact on the confidentiality of the data with no impact on the integrity and availability of the application.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-447458.1SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an CVE-2026-447466.1Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver JAVA (JDBC Test Servlet), an unauthenticated attacker could cra CVE-2026-447479.9SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory cor CVE-2026-447489.9SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed mes CVE-2026-447494.3The SAP Gateway allows attackers to inject content into error messages, potentially leading to disclosure of request artefacts (e.g., regex CVE-2026-44758.8A vulnerability has been found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The affected element is an unknown function of the fi CVE-2026-447504.3SAP MDG (Review Match Groups Application) does not perform the necessary authorization checks for authenticated users. This could allow a lo CVE-2026-447517.1Application server ABAP does not perform necessary authorization checks for an authenticated user allowing an attacker to execute a report g CVE-2026-447528.2SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim CVE-2026-447533.7SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable r CVE-2026-447546.6The Remote Function Call (RFC) modules of the Operational Data Provisioning Data Replication API (ODP-RFC) are missing caller identification CVE-2026-447554.3SAP Business Objects Business Intelligence Platform does not sufficiently validate email sending parameters supplied by authenticated users,